amazonlinux:2023 image size, layers and vulnerabilities (2026-11-01)

docker pull amazonlinux:2023amazonlinux@sha256:c04a1012acc483977f61f7f91c28624a39a621e56a59781319a75dec528be9b6

Size per platform

Compressed download size on Docker Hub for each architecture.

amd6455 MB
arm6454 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/lib6449 MB
/usr/lib64/python3.936 MB
/usr/share/locale23 MB
/usr/share/misc7.8 MB
/usr/bin6.6 MB
/usr/share/doc3.9 MB
/var/lib3.0 MB
/usr/lib64/ossl-modules2.8 MB
/usr/lib/python3.92.3 MB
/usr/share/pki2.0 MB

Layers

The 1 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (/rootfs/)55 MB

Full build steps

55 MBCOPY /rootfs/ / # buildkit

Known vulnerabilities

0Critical0 with a fix

15High15 with a fix

3Medium3 with a fix

0Low0 with a fix

0Unknown0 with a fix

18 findings across 106 packages; 18 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
High	CVE-2026-103111pcre2: pcre2: Out-of-bounds write via crafted regular expression	pcre2, pcre2-syntaxinstalled 10.40-1.amzn2023.0.4	10.40-1.amzn2023.0.5
High	CVE-2026-19553python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()	python3, python3-libsinstalled 3.9.25-1.amzn2023.0.9	3.9.25-1.amzn2023.0.11
High	CVE-2026-78659net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion	libcapinstalled 2.73-1.amzn2023.0.7	2.73-1.amzn2023.0.8
High	CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers	libcapinstalled 2.73-1.amzn2023.0.7	2.73-1.amzn2023.0.8
High	CVE-2026-86145pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions	pcre2, pcre2-syntaxinstalled 10.40-1.amzn2023.0.4	10.40-1.amzn2023.0.5
High	CVE-2026-89156PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback	pcre2, pcre2-syntaxinstalled 10.40-1.amzn2023.0.4	10.40-1.amzn2023.0.5
High	CVE-2026-89160pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching	pcre2, pcre2-syntaxinstalled 10.40-1.amzn2023.0.4	10.40-1.amzn2023.0.5
High	CVE-2026-92392curl: curl: HTTP/2 upload Use-After-Free	curl-minimal, libcurl-minimalinstalled 8.21.0-5.amzn2023.0.2	8.21.0-5.amzn2023.0.3
High	CVE-2026-94440net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing	libcapinstalled 2.73-1.amzn2023.0.7	2.73-1.amzn2023.0.8
Medium	CVE-2026-113470firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates	ca-certificatesinstalled 2025.2.76-1.0.amzn2023.0.3	2025.2.76-1.0.amzn2023.0.4
Medium	CVE-2026-114406ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns	ca-certificatesinstalled 2025.2.76-1.0.amzn2023.0.3	2025.2.76-1.0.amzn2023.0.5
Medium	CVE-2026-76781libxml2: libxml2: NULL pointer dereference parsing nextCatalog without catalog attribute	libxml2installed 2.10.4-1.amzn2023.0.21	2.10.4-1.amzn2023.0.22

Packages

RPM packages: 106

Image configuration

Base OS: Amazon Linux 2023.12.20261021
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: —
Command: /bin/bash
Exposed ports: none
Image created: 2026-10-23
amd64 digest: sha256:b156298161e9ab6392cda59081d016866601f7213a28ec21270d3a75c72f2170

Other Amazon Linux tags

amazonlinux:2023 vs almalinux:10-minimal

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:b156298161e9. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.